CVE-2026-12684
Deferred Deferred - Pending Action

Unauthenticated Media Upload in WooCommerce Customer Reviews

Publication date: 2026-07-16

Last updated on: 2026-07-16

Assigner: WPScan

Description
The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files (bounded to an image and video allowlist) to the Media Library and create attachment posts, leading to media library pollution and disk space exhaustion.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-16
Last Modified
2026-07-16
Generated
2026-08-05
AI Q&A
2026-07-16
EPSS Evaluated
2026-08-04
NVD
CVE-2026-12684
EUVD
EUVD-2026-44877

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
woocommerce customer_reviews to 5.113.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Customer Reviews for WooCommerce WordPress plugin before version 5.113.0. It allows unauthenticated users to upload media files like images and videos to the WordPress Media Library through an exposed AJAX action called 'cr_upload_media'. The plugin fails to check authentication, user capabilities, or security tokens before processing these uploads.

Detection Guidance

Check if the 'Customer Reviews for WooCommerce' plugin is installed and verify its version. If the version is below 5.113.0, the system is vulnerable. Inspect WordPress logs for unusual media upload activities or unauthorized AJAX requests to 'cr_upload_media'.

Impact Analysis

This vulnerability can lead to media library pollution by filling it with unwanted files. Attackers could host content on your domain, potentially serving malicious or inappropriate media. It may also cause denial-of-service by exhausting disk space through repeated uploads. However, file uploads are restricted to allowed extensions like PNG, JPG, or MP4.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized media uploads storing attacker-hosted content on the victim's domain, potentially exposing sensitive data or violating data integrity and access control requirements.

Mitigation Strategies

Update the 'Customer Reviews for WooCommerce' plugin to version 5.113.0 or later. If an update is not immediately available, disable the plugin or restrict access to the 'cr_upload_media' AJAX action via server-side rules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12684. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart